kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first
checking whether the in-kernel LAPIC has been initialized.  If it has
not (e.g. the vCPU was created without an in-kernel LAPIC), the
dereference results in a NULL pointer access.

While APIC-write VM-Exits are not expected to occur on a vCPU without
an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against
such a scenario as a defense-in-depth measure, e.g. to guard against
KVM bugs or CPU errata that could generate a spurious APIC-write
VM-Exit.

Add a WARN_ON_ONCE() guard and bail early if vcpu->arch.apic is NULL.

Found by a VMCS-targeted fuzzer based on syzkaller.

Signed-off-by: xuanqingshi <1356292400@qq.com>
---
 arch/x86/kvm/lapic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9381c58d4c85..0f9d314dfa2a 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2657,6 +2657,9 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
+	if (WARN_ON_ONCE(!apic))
+		return;
+
 	/*
 	 * ICR is a single 64-bit register when x2APIC is enabled, all others
 	 * registers hold 32-bit values.  For legacy xAPIC, ICR writes need to
-- 
2.25.1

On Thu, Mar 05, 2026, xuanqingshi wrote:
> kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first
> checking whether the in-kernel LAPIC has been initialized.  If it has
> not (e.g. the vCPU was created without an in-kernel LAPIC), the
> dereference results in a NULL pointer access.
> 
> While APIC-write VM-Exits are not expected to occur on a vCPU without
> an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against
> such a scenario as a defense-in-depth measure, e.g. to guard against
> KVM bugs or CPU errata that could generate a spurious APIC-write
> VM-Exit.
> 
> Add a WARN_ON_ONCE() guard and bail early if vcpu->arch.apic is NULL.
> 
> Found by a VMCS-targeted fuzzer based on syzkaller.

Found how exactly?  If you managed to actually hit a NULL pointer deref here,
that *significantly* changes the value of adding defense in depth.

> Signed-off-by: xuanqingshi <1356292400@qq.com>
> ---
>  arch/x86/kvm/lapic.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
> index 9381c58d4c85..0f9d314dfa2a 100644
> --- a/arch/x86/kvm/lapic.c
> +++ b/arch/x86/kvm/lapic.c
> @@ -2657,6 +2657,9 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
>  {
>  	struct kvm_lapic *apic = vcpu->arch.apic;
>  
> +	if (WARN_ON_ONCE(!apic))
> +		return;

Hmm, a simple WARN isn't a net positive.  If the CPU generates a spurious APICv/AVIC
VM-Exit, or KVM managed to enable one or the other without an in-kernel local
APIC, then I'd *much* prefer a crash due to a NULL pointer dereference.  Letting
the vCPU continue on in this state would be disastrous for the guest.

But luckily we have KVM_BUG_ON().  And we can use lapic_in_kernel() to make this
"free" for the overwhelming majority of setups, which always use an in-kernel
local APIC (in which case lapic_in_kernel() is a static branch that returns true).

	if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm))
		return;

kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first
checking whether the in-kernel LAPIC has been initialized.  If it has
not (e.g. the vCPU was created without an in-kernel LAPIC), the
dereference results in a NULL pointer access.

While APIC-write VM-Exits are not expected to occur on a vCPU without
an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against
such a scenario as a defense-in-depth measure, e.g. to guard against
KVM bugs or CPU errata that could generate a spurious APIC-write
VM-Exit.

Use KVM_BUG_ON() with lapic_in_kernel() instead of a simple
WARN_ON_ONCE(), as suggested by Sean Christopherson, so that KVM
kills the VM outright rather than letting it continue in a broken
state.

Found by a VMCS-targeted fuzzer based on syzkaller.

Signed-off-by: xuanqingshi <1356292400@qq.com>
---
 arch/x86/kvm/lapic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 9381c58d4c85..02f2039d5f99 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2657,6 +2657,9 @@ void kvm_apic_write_nodecode(struct kvm_vcpu *vcpu, u32 offset)
 {
 	struct kvm_lapic *apic = vcpu->arch.apic;
 
+	if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm))
+		return;
+
 	/*
 	 * ICR is a single 64-bit register when x2APIC is enabled, all others
 	 * registers hold 32-bit values.  For legacy xAPIC, ICR writes need to
-- 
2.25.1

On Fri, 06 Mar 2026 17:12:32 +0800, xuanqingshi wrote:
> kvm_apic_write_nodecode() dereferences vcpu->arch.apic without first
> checking whether the in-kernel LAPIC has been initialized.  If it has
> not (e.g. the vCPU was created without an in-kernel LAPIC), the
> dereference results in a NULL pointer access.
> 
> While APIC-write VM-Exits are not expected to occur on a vCPU without
> an in-kernel LAPIC, kvm_apic_write_nodecode() should be robust against
> such a scenario as a defense-in-depth measure, e.g. to guard against
> KVM bugs or CPU errata that could generate a spurious APIC-write
> VM-Exit.
> 
> [...]

Applied to kvm-x86 misc.  I still want to understand what "Found by a VMCS-targeted
fuzzer based on syzkaller" means, but this is decent hardening regardless.

Thanks!

[1/1] KVM: x86: Add LAPIC guard in kvm_apic_write_nodecode()
      https://github.com/kvm-x86/linux/commit/26c9bfc0fac2

--
https://github.com/kvm-x86/linux/tree/next